root: switch cspell to typo-only reporting (#24701)

* root: switch cspell to typo-only reporting

cSpell's default mode reports every word it does not recognize, so each
new integration name or identifier needed a dictionary entry. Switch to
unknownWords: report-common-typos, which matches CodeSpell's behavior:
only known misspellings (reported with a suggested fix) and flagWords
fail the check.

Remove the per-topic dictionaries and word-shape ignore regexes this
makes unnecessary, fix the 18 typos the old allowlists were masking,
and document the new workflow.

Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW

* web/docs: fix style-loader-plugin path and wording in CSS architecture doc

Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW

* website: remove stray blank lines left by ignore-comment removal

Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW

AGENTS.md

@@ -30,7 +30,7 @@ packages/           # Shared workspace packages, polyglot:
 web/                # TypeScript web UI (own AGENTS.md)
 website/            # Docs / integrations / API sites (own AGENTS.md)
 blueprints/         # YAML declarative config (default/ system/ example/) applied at startup
-locale/             # Backend translations (.po) + shared cspell dictionaries (en/dictionaries/)
+locale/             # Backend translations (.po) + cspell overrides dictionary (en/dictionaries/)
 tests/              # Cross-cutting test support: e2e/, integration/, geoip/, openid_conformance/
 schemas/            # Third-party XSD/JSON schemas (SAML, WS-*, SCIM) used at runtime
 scripts/            # Repo automation (schema build, compose generation, node setup, semver)
@@ -106,7 +106,7 @@ make web-test          # Web UI tests (delegates to web/)
 ```bash
 make lint-fix          # Auto-fix: black + ruff (Python) and rustfmt (Rust)
 make lint              # Check: bandit, mypy --strict, golangci-lint, cargo deny/machete
-make lint-spellcheck   # cspell across the repo (shared dictionaries in locale/en/dictionaries/)
+make lint-spellcheck   # cspell across the repo (typo-only mode: reports known misspellings and forbidden British spellings, not unknown words)
 make lint-catalogs     # pnpm catalog pins in sync across the root/web/website workspaces
 ```
 

authentik/lib/utils/reflection.py

@@ -16,7 +16,7 @@ LOGGER = get_logger()
 
 
 def all_subclasses[T: type](cls: T, sort=True) -> list[T] | set[T]:
-    """Recursively return all subclassess of cls"""
+    """Recursively return all subclasses of cls"""
     classes = set(cls.__subclasses__()).union(
         [s for c in cls.__subclasses__() for s in all_subclasses(c, sort=sort)]
     )

authentik/outposts/signals.py

@@ -118,7 +118,7 @@ for subclass in OutpostModel.__subclasses__():
 
 def outpost_reverse_related_post_save(sender, instance: CertificateKeyPair | Brand, **_):
     for field in instance._meta.get_fields():
-        # Each field is checked if it has a `related_model` attribute (when ForeginKeys or M2Ms)
+        # Each field is checked if it has a `related_model` attribute (when ForeignKeys or M2Ms)
         # are used, and if it has a value
         if not hasattr(field, "related_model"):
             continue

cspell.config.jsonc

@@ -5,6 +5,13 @@
     "version": "0.2",
     "readonly": true,
     "language": "en-US",
+    // Only report words that are known misspellings (with a suggested fix) or
+    // explicitly forbidden via `flagWords`. Unknown-but-plausible words — project
+    // jargon, identifiers, integration names — pass silently, so new terms do not
+    // require dictionary entries. This mirrors CodeSpell's behavior, which checks
+    // against a curated list of common misspellings rather than flagging every
+    // word absent from a dictionary.
+    "unknownWords": "report-common-typos",
     "cache": {
         "useCache": true,
         "cacheLocation": "./.cspellcache",
@@ -19,68 +26,18 @@
             }
         ]
     ],
+    // In typo-only mode, a dictionary entry is needed only when a legitimate term
+    // collides with the common-misspellings list. Record such collisions here
+    // rather than reviving per-topic dictionary files.
     "dictionaryDefinitions": [
         {
-            "name": "en-x-authentik-software-terms",
+            "name": "en-x-authentik-overrides",
-            "path": "./locale/en/dictionaries/software-terms.txt",
+            "path": "./locale/en/dictionaries/overrides.txt",
-            "description": "English software-related terms",
+            "description": "Legitimate terms that collide with the common-misspellings list",
             "addWords": true
-        },
-        {
-            "name": "en-x-authentik-idp",
-            "path": "./locale/en/dictionaries/idp.txt",
-            "description": "English IdP words",
-            "addWords": true
-        },
-        {
-            "name": "en-x-authentik-python",
-            "path": "./locale/en/dictionaries/python.txt",
-            "addWords": true
-        },
-        {
-            "name": "en-x-authentik-rust",
-            "path": "./locale/en/dictionaries/rust.txt",
-            "addWords": true
-        },
-        {
-            "name": "en-x-authentik-golang",
-            "path": "./locale/en/dictionaries/golang.txt",
-            "addWords": true
-        },
-        {
-            "name": "en-x-authentik-people",
-            "path": "./locale/en/dictionaries/people.txt",
-            "description": "People names relevant to authentik",
-            "addWords": true
-        },
-        {
-            "name": "en-x-authentik-integrations",
-            "path": "./locale/en/dictionaries/integrations.txt",
-            "description": "English integration names",
-            "addWords": true
-        },
-        {
-            "name": "en-x-authentik-ignore",
-            "path": "./locale/en/dictionaries/ignore.txt",
-            "description": "English ignore list for authentik",
-            "addWords": true,
-            "noSuggest": true
         }
     ],
-    "dictionaries": [
+    "dictionaries": ["en-x-authentik-overrides"],
-        "en-x-authentik-software-terms",
-        "en-x-authentik-idp",
-        "en-x-authentik-ignore",
-        "en-x-authentik-people",
-        "en-x-authentik-integrations",
-        "node",
-        "softwareTerms",
-        "software-tools",
-        "computing-acronyms",
-        "companies",
-        "cpp-compound-words"
-    ],
-    "allowCompoundWords": true,
     // British spellings to reject in favor of American variants. The `->` form
     // forbids the left word and offers the right word as the suggested fix.
     "flagWords": [
@@ -162,75 +119,25 @@
             "name": "EncodedURI",
             "description": "Encoded URIs, which are common in authentik's codebase and often contain many false positives.",
             "pattern": "[a-zA-Z]+%3A%2F%2F.+"
-        },
-        {
-            "name": "ConfSuffix",
-            "description": "Variables with `conf` or `config` suffix",
-            "pattern": ["\\w+(conf|config)\\b", "\\b(conf|config)\\w+"]
         }
     ],
+    // Only content-scoping patterns belong here (encoded blobs, upstream
+    // identifiers spelled the British way) — not word allowlists. Unknown words
+    // are no longer reported, so shape-of-word escapes are unnecessary.
     "ignoreRegExpList": [
-        // DB Migrations
+        // Encoded URIs
-        "authentik_c_\\w+_[0-9a-fA-F]+_idx",
+        "EncodedURI",
-        // Google Analytics
-        "/G-[0-9A-Z]+/",
-        // Github Usernames
-        "@[a-zA-Z0-9_-]+",
-        // GitHub repositories
-        "github\\.com/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+",
-        // Docker images
-        "docker\\.io/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+",
-        // Suffix "change", which is common in migration files
-        "\\w+change\\b",
-        // Prefix "on", which is common in event handlers
-        "\\bon\\w+\\b",
-        // Prefix "pg", which is common in PostgreSQL-related code
-        "\\bpg\\w+\\b",
-        // Prefix "pf", which is common in PatternFly-related code
-        "\\bpf\\w+\\b",
-        // Prefix "ws", which is common in WebSocket-related code
-        "\\bws\\w+\\b",
-        // Suffix "propertymapping"
-        "\\w+propertymapping\\b",
-        // Words that end with "source", "provider", "user", "group", or "connection",
-        // which are common in authentik's codebase and often contain many false positives.
-        "\\w+(source|provider)(user|group|connection)\\b",
-        "\\w+(source|provider)(user|group|connection)",
         // Basic auth header
         "Basic [a-zA-Z0-9+/=]+",
-        // "ify" suffix, e.g. "stringify", "classify".
-        "\\w+l?ify\\b",
-        // "ified" suffix, e.g. "stringified", "classified".
-        "\\w+l?ified\\b",
-        // "ifying" suffix, e.g. "stringifying", "classifying".
-        "\\w+l?ifying\\b",
         // PatternFly's grey label modifier is spelled the British way upstream.
         "pf-m-grey",
-        // Other terms we needed
+        // lit-analyzer's CLI and its build phase are spelled the British way upstream.
-        "AKQL",
+        "analyse-phase",
-        "Base64",
+        "lit-analyse"
-        "Email",
-        "EncodedURI",
-        "FOUC", // Flash Of Unstyled Content
-        "HashStrings",
-        "PublicKey",
-        "RsaCert",
-        "SpellCheckerIgnoreInDocSetting",
-        "SshRsa",
-        "UnicodeRef",
-        "Urls",
-        "analyse-phase", // UK Spelling
-        "href",
-        "lit-analyse" // UK Spelling
     ],
     "languageSettings": [
         {
             "languageId": "markdown,mdx",
-            "dictionaries": [
-                "en-x-authentik-python",
-                "en-x-authentik-rust",
-                "en-x-authentik-golang"
-            ],
             "ignoreRegExpList": [
                 // Fenced code blocks
                 "/^\\s*```[\\s\\S]*?^\\s*```/gm",
@@ -242,16 +149,6 @@
         {
             "languageId": "typescript,javascript,typescriptreact,javascriptreact,mdx,astro",
             "ignoreRegExpList": [
-                // Event handlers e.g. onClick, onmouseover
-                "\\bon\\w+\\b",
-                // Custom web component tags e.g. <ak-button>, <ak-toggle-group>
-                "</?ak-[a-z0-9-]+",
-                // Scoped import paths, e.g. @webcomponents/webcomponentsjs
-                "@[a-z0-9-]+/[a-z0-9-]+",
-                // Import paths that end with "js", which are often false positives
-                // and not worth the effort of creating a custom dictionary for.
-                "[a-z0-9-]+js",
-                "ConfSuffix",
                 "js-hex-escape",
                 "js-unicode-escape",
                 "js-regexp-flags",
@@ -260,25 +157,8 @@
         },
         {
             "languageId": "python",
-            "dictionaries": ["en-x-authentik-python"],
             "includeRegExpList": ["comments"]
         },
-        {
-            "languageId": "rust",
-            "dictionaries": ["en-x-authentik-rust"]
-        },
-        {
-            "languageId": "go",
-            "dictionaries": ["en-x-authentik-golang"]
-        },
-        {
-            "languageId": "makefile,toml,yaml",
-            "dictionaries": [
-                "en-x-authentik-python",
-                "en-x-authentik-rust",
-                "en-x-authentik-golang"
-            ]
-        },
         {
             "languageId": "css,scss",
             "ignoreRegExpList": [
@@ -292,7 +172,6 @@
         "{cspell.*,cSpell.*,.cspell.*,cspell.config.*}", // CSpell configuration files
         "cspell-report.{json,html,txt}", // CSpell report files
         "dictionaries", // Custom dictionary files
-        "ignore.txt", // Custom ignore list files
         "./locale", // Locale files (Django, CSpell)
         "web/xliff", // XLIFF translation files
         "web/src/locales", // Generated TypeScript locale

locale/en/dictionaries/golang.txt

@@ -1,20 +0,0 @@
-# Golang-specific terms
-gounicorn
-pems
-connm
-Debugf
-Infof
-Warnf
-layeh
-Warningf
-goldap
-goauthentikio
-singlevg
-accsp
-uapisp
-GORMDB
-golangci
-gorm
-gorm
-gorm*
-logger

locale/en/dictionaries/idp.txt

@@ -1,9 +0,0 @@
-# IdP-specific terms
-authentik
-Yubi
-Yubikey
-Yubikeys
-mycorp
-mocksaml
-VSCHAR
-pbms

locale/en/dictionaries/ignore.txt

@@ -1,27 +0,0 @@
-# Ignored terms that should not be suggested by the spell checker.
-aaguids
-ASGI
-asgi
-azuread
-Azuread
-buildx
-goauthentik
-llmstxt
-lxml
-pässwörd
-phlebotinum
-qewr
-quox
-recategorize
-reinject
-tmpfs
-trixie
-XFCC
-xghcr
-xoxb
-xoxe
-xoxp
-foo
-bar
-baz
-qux

locale/en/dictionaries/integrations.txt

@@ -1,91 +0,0 @@
-# Integrations
-ADOM
-Apereo
-appflowy
-appsmith
-Ascensio
-Authy
-Beszel
-Bitnami
-Budibase
-Chatwoot
-Coolify
-Directus
-Doki
-Doku
-dokuwiki
-Dozzle
-Engomo
-Espo
-espocrm
-ezBookkeeping
-fleetdm
-Flowy
-Forgejo
-Forti
-Fortigate
-Gatus
-Gestionnaire
-ghec
-Gitea
-Gravitee
-grommunio
-HACS
-Homarr
-Icinga
-Informatique
-Jellyseerr
-Kavita
-Kimai
-Kiota
-Knoc
-Knocknoc
-Komodo
-Kubeconfig
-Mautic
-Mobilizon
-myabsorb
-n8n
-NocoDB
-Nexterm
-Observium
-Ofair
-Ollama
-Omada
-Omnissa
-omniauth
-openwebui
-OPNsense
-Orchesta
-Organizr
-Packagify
-Palo
-Papra
-Personio
-PhotoPrism
-pfSense
-phpipam
-Planka
-Plesk
-PostHog
-proftpd
-pveum
-Qube
-Relatedly
-Seerr
-Sidero
-snipeit
-sonarqube
-Technitium
-Terrakube
-Ueberauth
-Veeam
-Vikunja
-Wazuh
-Wdio
-Weixin
-Wekan
-Xcreds
-Zammad
-Zenko
-Zulip

locale/en/dictionaries/overrides.txt

@@ -0,0 +1,4 @@
+# Legitimate terms that the spell checker's common-misspellings list would
+# otherwise report as typos. Only add a word here when `make lint-spellcheck`
+# flags it with a suggested "fix" and the original spelling is intentional.
+ontext

locale/en/dictionaries/people.txt

@@ -1,16 +0,0 @@
-# People names.
-Bery
-Beryju
-Teffen
-GirlBossRush
-Gergo
-Marc
-Dewi
-Zwanenburg
-Naur
-Wärting
-Aadit
-Kilby
-Kahmen
-Hodgman
-Sutherland

locale/en/dictionaries/python.txt

@@ -1,13 +0,0 @@
-debugpy
-dramatiq
-kwargs
-pgtrigger
-psycopg
-pyrad
-uvicorn
-pglock
-dicted
-mypy
-klass
-pgactivity
-kinit

locale/en/dictionaries/rust.txt

@@ -1,16 +0,0 @@
-allinone
-argh
-clippy
-impls
-moka
-nasm
-netns
-pointee
-rcgen
-repr
-serde
-sqlx
-tcpv
-tungstenite
-unseparated
-zstd

locale/en/dictionaries/software-terms.txt

@@ -1,198 +0,0 @@
-# Software-specific terms
-*_c_name_*
-*_c_slug_*
-*ecdsa*
-*entra*
-*id*
-*identities
-*identity
-*ids*
-*idx*
-*mapping*
-*name*
-*named*
-*names*
-*namespace*
-*namespaces
-*plex*
-*provider
-+Xmldsig+
-ADFS
-AKMDX
-ASVS
-Algs
-Backblaze
-CASB
-CLDR
-Cloudflare
-DOTADIW
-Docsmg
-DTCG
-GDTC
-GHES
-GHSA
-GLPI
-GitGuardian
-Guac
-Guacd
-Gunicorn
-HIBP
-HOTP
-Hackathon
-ISPM
-ITDR
-Kadmin
-LDAPCP
-LSPATH
-Liskov
-MDSCIM
-MYNIS
-Moreecdsa
-NGFW
-OCAK
-OCNS
-PEAP
-PKCE
-PSSO
-Pooler
-Pyroscope
-QNAP
-RAC
-RHAAP
-SCIM
-SDKJS
-SMTPD
-SNPEGO
-SPSSO
-SVGOMG
-SeaweedFS
-Sfdc
-Symfony
-TOTP
-Transifex
-Unenrollment
-Unmigrate
-USWDS
-Wasabi
-Wsfed
-Xen
-Xmldsig
-XmldsigMore
-ZTNA
-aaguid
-adsi
-akflow
-akprox
-allinone
-asns
-backblazeb2
-cbor
-cloudflarestorage
-copylefted
-cves
-describedby
-dialector
-docsmg
-doseq
-dsa
-dsquery
-ellipsized
-esbuild
-falsey
-frie
-gcsp
-geoip
-geojson
-geojsonl
-glpi
-gosaml
-grecaptcha
-hasc
-hexworld
-guac
-guacd
-gunicorn
-hackathon
-haveibeenpwned
-hcaptcha
-hibp
-hotp
-hres
-kadmin
-kiprop
-kubeadm
-labelledby
-wasabisys
-LLM
-LLMS
-mcomplete
-mermaidjs
-microsoft
-mmdb
-lngs
-lons
-maplibre
-maplibregl
-noopener
-noreferrer
-ocsp
-oktadev
-openidc
-ouia
-ouid
-peap
-pkce
-pmtiles
-plex
-protomaps
-postgresstore
-proxyv
-psso
-pydantic
-pyroscope
-rapi
-rasterizes
-rbcervilla
-recws
-retag
-rnds
-rsa
-runit
-RSTR
-sbdocs
-schedulable
-scim
-scsp
-sha
-source
-stringly
-sysd
-tdialector
-templatize
-tippecanoe
-tgcsp
-tguacd
-tgunicorn
-totp
-tscsp
-ttotp
-tuisp
-uisp
-unenrollment
-unhashed
-unmigrate
-unscalable
-unskippable
-unsynchronized
-uperm
-uwsgi
-wireit
-wsfed
-wtrealm
-xen+
-xenc
-yamltags
-zxcvbn
-~uuid
-~uuids
-wreply

packages/ak-common/src/tokio/proxy_protocol/header.rs

@@ -103,7 +103,7 @@ pub enum Tlv<'a> {
     /// Contains the host name value passed by the client, as an UTF-8 encoded string. In case of
     /// TLS being used on the client connection, this is the exact copy of the `server_name`
     /// extension as defined by RFC3546, section 3.1, often referred to as SNI. There are probably
-    /// other situations where an authority can be mentionned on a connection without TLS being
+    /// other situations where an authority can be mentioned on a connection without TLS being
     /// involved at all.
     Authority(Cow<'a, str>),
 

packages/geo/test/labels.test.ts

@@ -37,7 +37,6 @@ test("normalizePlace accepts legacy pmap:-prefixed names", () => {
 });
 
 test("normalizePlace rejects unwanted kinds and nameless places", () => {
-    // spellchecker:disable-next-line
     expect(normalizePlace({ kind: "neighbourhood", name: "Mitte" }, 0, 0)).toBe(null);
     expect(normalizePlace({ kind: "locality" }, 0, 0)).toBe(null);
 });
@@ -99,7 +98,6 @@ test("country reveal zoom is tiered by population, not the dump's min_zoom", ()
         normalizePlace(
             {
                 "kind": "country",
-                // spellchecker:disable-next-line
                 "name": "Österreich",
                 "name:en": "Austria",
                 "min_zoom": 4,

scripts/node/utils/node.mjs

@@ -67,7 +67,7 @@ export function loadJSON(jsonPath) {
         });
 }
 
-const PackageJSONComparisionFields = /** @type {const} */ ([
+const PackageJSONComparisonFields = /** @type {const} */ ([
     "name",
     "dependencies",
     "devDependencies",
@@ -77,14 +77,14 @@ const PackageJSONComparisionFields = /** @type {const} */ ([
 ]);
 
 /**
- * @typedef {typeof PackageJSONComparisionFields[number]} PackageJSONComparisionField
+ * @typedef {typeof PackageJSONComparisonFields[number]} PackageJSONComparisonField
  */
 
 /**
  * Extracts only the dependency fields from a package.json object for comparison purposes.
  *
  * @param {PackageJSON} data
- * @returns {Pick<PackageJSON, PackageJSONComparisionField>}
+ * @returns {Pick<PackageJSON, PackageJSONComparisonField>}
  */
 export function pluckDependencyFields(data) {
     /**
@@ -92,13 +92,13 @@ export function pluckDependencyFields(data) {
      */
     const result = {};
 
-    for (const field of PackageJSONComparisionFields) {
+    for (const field of PackageJSONComparisonFields) {
         if (data[field]) {
             result[field] = data[field];
         }
     }
 
-    return /** @type {Pick<PackageJSON, PackageJSONComparisionField>} */ (result);
+    return /** @type {Pick<PackageJSON, PackageJSONComparisonField>} */ (result);
 }
 
 //#region Versioning

web/docs/arch/2026-06-18-How-CSS-Is-Made-And-Next-Steps.md

@@ -5,9 +5,9 @@
 This document describes how the CSS is built in our current system, and what we can do to make that
 process less challenging and fraught with difficulties:
 
-## styleLoaderPlugin (./bundler/style-loader-pluging/node.js)
+## styleLoaderPlugin (./bundler/style-loader-plugin/node.js)
 
-All of our CSS is complied together by this ESBuild plug.
+All of our CSS is compiled together by this ESBuild plugin.
 
 ## ./scripts/build-web.mjs
 

web/src/admin/providers/radius/RadiusProviderFormForm.ts

@@ -32,7 +32,7 @@ const mfaSupportHelp = msg(
 );
 
 const clientNetworksHelp = msg(
-    "List of CIDRs (comma-seperated) that clients can connect from. A more specific CIDR will match before a looser one. Clients connecting from a non-specified CIDR will be dropped.",
+    "List of CIDRs (comma-separated) that clients can connect from. A more specific CIDR will match before a looser one. Clients connecting from a non-specified CIDR will be dropped.",
 );
 
 export interface RADIUSProviderFormProps {

web/src/admin/users/UserListPage.ts

@@ -204,7 +204,7 @@ export class UserListPage extends WithLicenseSummary(
         [msg("Actions"), null, msg("Row Actions")],
     ];
 
-    //#region Renderering
+    //#region Rendering
 
     protected override renderToolbarSelected(): TemplateResult {
         const disabled = this.selectedElements.length < 1;

web/src/elements/LicenseNotice.ts

@@ -9,7 +9,7 @@ import { css, html, nothing } from "lit";
 import { customElement, property } from "lit/decorators.js";
 
 @customElement("ak-license-notice")
-export class AKLicenceNotice extends WithLicenseSummary(AKElement) {
+export class AKLicenseNotice extends WithLicenseSummary(AKElement) {
     public static styles = [
         css`
             ::part(container) {
@@ -44,6 +44,6 @@ export class AKLicenceNotice extends WithLicenseSummary(AKElement) {
 
 declare global {
     interface HTMLElementTagNameMap {
-        "ak-license-notice": AKLicenceNotice;
+        "ak-license-notice": AKLicenseNotice;
     }
 }

web/src/styles/global/locales/ja/globals.css

@@ -4,16 +4,12 @@
 
 html[lang="ja"],
 html[lang^="ja-"] {
-    /* spellchecker:disable */
-
     --ak-font-family-sans-serif:
         "M PLUS 2", "Noto Sans JP", "Hiragino Kaku Gothic Pro", "ヒラギノ角ゴ Pro W3", メイリオ,
         Meiryo, "ＭＳ Ｐゴシック", var(--ak-generic-sans-serif);
 
     --ak-font-family-serif: "Noto Serif JP", var(--ak-generic-serif);
 
-    /* spellchecker:enable */
-
     --ak-font-family-heading: var(--ak-font-family-sans-serif);
 
     --pf-c-content--h1--FontWeight: 500;

web/src/styles/global/locales/zh/globals.css

@@ -3,8 +3,6 @@
  */
 
 html[lang^="zh"] {
-    /* spellchecker:disable */
-
     --ak-font-family-sans-serif:
         "Noto Sans SC", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei",
         sans-serif, var(--ak-generic-sans-serif);
@@ -15,8 +13,6 @@ html[lang^="zh"] {
         "Noto Sans SC", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei",
         sans-serif;
 
-    /* spellchecker:enable */
-
     --pf-c-content--h1--FontWeight: 500;
 
     body {

web/test/unit/unescape-locale-entities.test.ts

@@ -1,4 +1,3 @@
-// cspell:ignore bearbeiten Versuche Beispielsweise nichts sehen Avaa
 import { sanitizeLocaleModule } from "../../scripts/unescape-locale-entities.mjs";
 
 import { describe, expect, it } from "vitest";

web/types/dom.d.ts

@@ -2,8 +2,6 @@
  * @file Global DOM-related types.
  */
 
-/* spellchecker:ignore closedBy */
-
 export {};
 
 declare global {

web/types/rapi-doc/index.d.ts

@@ -2,7 +2,6 @@ declare module "rapidoc" {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     type Booleanish = "true" | "false";
 
-    // spellchecker:disable
     /**
      * Web Component based Swagger & OpenAPI Spec Viewer
      *
@@ -73,7 +72,6 @@ declare module "rapidoc" {
      * @attr {string} api-key-value - Value of the API key (can be overwritten from UI).
      * @attr {"omit" | "same-origin" | "include"} fetch-credentials - Credentials mode for cross-domain calls.
      */
-    // spellchecker:enable
     class RapiDoc extends HTMLElement {
         /**
          * Programmatically load a spec.

website/AGENTS.md

@@ -128,15 +128,14 @@ Avoid renaming/moving pages unless necessary; better organization rarely justifi
 
 ## Spell checking
 
-Spell checking uses **cspell** (`make lint-spellcheck`, config `../cspell.config.jsonc`). Custom dictionaries live in `../locale/en/dictionaries/` (`software-terms.txt`, `integrations.txt`, `idp.txt`, language-specific lists, `people.txt`, `ignore.txt`). Add genuinely new product/service/technology terms to the appropriate dictionary rather than rewording correct prose; never disable the checker for a whole page.
+Spell checking uses **cspell** (`make lint-spellcheck`, config `../cspell.config.jsonc`) in typo-only mode (`unknownWords: "report-common-typos"`): it reports only words on the common-misspellings list (always with a suggested fix) and forbidden British spellings. Unknown words — product names, jargon, identifiers — pass silently, so a new integration or technology term needs **no** dictionary entry.
 
-For a genuine one-off that does not belong in a dictionary (a deliberate misspelling in an example, an opaque token), use an inline cspell comment scoped as tightly as possible:
+If the checker flags a word whose spelling is intentional (a third-party API member, a deliberate misspelling in an example), either:
 
-- `<!-- spellchecker:ignore someword anotherword -->` in Markdown/MDX, or `// spellchecker:ignore ...` in code — allow specific words for the rest of the file.
+- add it to `../locale/en/dictionaries/overrides.txt` if it may recur across files, or
-- `<!-- spellchecker:disable-next-line -->` / `// spellchecker:disable-next-line` — skip just the following line.
+- use an inline comment scoped as tightly as possible for a true one-off: `<!-- spellchecker:ignore someword -->` in Markdown/MDX (`// spellchecker:ignore ...` in code), or `<!-- spellchecker:disable-next-line -->` for a single line.
-- `<!-- spellchecker:disable -->` … `<!-- spellchecker:enable -->` — skip a bounded region (avoid; prefer the narrower forms).
 
-Reach for a dictionary entry first — inline ignores are for the rare case the term is truly local to one page.
+Never disable the checker for a whole page.
 
 ## Deployment
 
@@ -161,6 +160,6 @@ Every PR gets a Netlify Deploy Preview — use it to verify rendering, links, an
 | Build runtime  | Node ≥ 24, npm ≥ 11 (run via `corepack`)                                            |
 | Package layout | NPM Workspaces (`docs`, `integrations`, `api`, `docusaurus-theme`)                  |
 | Lint / format  | ESLint 9 (`@goauthentik/eslint-config`) + Prettier (`@goauthentik/prettier-config`) |
-| Spell check    | cspell + shared dictionaries                                                        |
+| Spell check    | cspell (typo-only mode)                                                             |
 | Types          | TypeScript (`tsc -b`)                                                               |
 | Hosting        | Netlify + GitHub Actions                                                            |

website/docs/developer-docs/frontend/cascade-layers.md

@@ -4,8 +4,6 @@ sidebar_label: Cascade layers
 description: How authentik's web UI orders its CSS with @layer, and where each kind of rule belongs.
 ---
 
-<!-- cspell:words unlayered -->
-
 authentik's document CSS is ordered with [cascade layers](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@layer). Layers make the ordering explicit, so a rule's precedence comes from the layer it is assigned to rather than from where it happens to be imported or how specific its selector is.
 
 ## The layer order

website/docs/developer-docs/frontend/css-architecture.md

@@ -4,8 +4,6 @@ sidebar_label: CSS architecture
 description: How authentik's runtime CSS and design tokens fit together across the theme package, the document cascade, and Lit components.
 ---
 
-<!-- cspell:words DTCG Styleframe -->
-
 authentik's UI is a customized PatternFly 4 system wrapped in Lit web components. Treat PatternFly as a compatibility layer, not the public API to build on: the stable surface is the `--ak-*` token set.
 
 ## The pieces

website/docs/releases/2022/v2022.12.md

@@ -137,7 +137,7 @@ image:
 - web/admin: rework outpost health
 - web/elements: add grouping and descriptions to search select
 - web/elements: make ak-search-select limited in height and scroll
-- web/elements: render ak-seach-select dropdown correctly in modals
+- web/elements: render ak-search-select dropdown correctly in modals
 - web/user: fix user settings stuck loading
 
 ## Fixed in 2022.12.2

website/docs/releases/2024/v2024.2.md

@@ -213,7 +213,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.2
 - enterprise: add full audit log (#8177)
 - enterprise: fix system task missing set_status (#8455)
 - enterprise: rework license summary caching (#8501)
-- enterrpise: exclude inactive users from license (#8294)
+- enterprise: exclude inactive users from license (#8294)
 - events: add ASN Database reader (#7793)
 - events: add better fallback for sanitize_item to ensure everything can be saved as JSON (#7694)
 - events: add graph for event volume (#7639)

website/docs/releases/2024/v2024.4.md

@@ -3,8 +3,6 @@ title: Release 2024.4
 slug: /releases/2024.4
 ---
 
-<!-- cSpell:ignore moar -->
-
 ## Highlights
 
 - **OAuth/SAML as authentication factor** :ak-enterprise Use an external provider as part of an MFA authentication flow, including custom implementations

website/docs/releases/2025/v2025.12.md

@@ -3,8 +3,6 @@ title: Release 2025.12
 slug: "/releases/2025.12"
 ---
 
-<!-- spellchecker:ignore fqxr xjjx -->
-
 ## Highlights
 
 - **Endpoint Devices**: :ak-enterprise :ak-preview Endpoint Devices is a new feature set for Windows, macOS, and Linux devices that enables SSH authentication, local device login, and more, all with authentik credentials. See the [Endpoint Devices docs](../../endpoint-devices/index.mdx) for more details.
@@ -459,7 +457,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.12
 - providers/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2025.12) (#20692)
 - providers/radius: fix message authenticator validation (cherry-pick #21824 to version-2025.12) (#21827)
 - providers/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2025.12) (#21283)
-- proviers/ldap: avoid concurrent header writes in API Client (cherry-pick #21223 to version-2025.12) (#21227)
+- providers/ldap: avoid concurrent header writes in API Client (cherry-pick #21223 to version-2025.12) (#21227)
 - root: do not rely on npm cli for version bump (cherry-pick #20276 to version-2025.12) (#20320)
 - root: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2025.12) (#21354)
 - root: update django to 5.2.14 (cherry-pick #22064 to version-2025.12) (#22065)

website/docs/releases/2026/v2026.2.md

@@ -3,8 +3,6 @@ title: Release 2026.2
 slug: "/releases/2026.2"
 ---
 
-<!-- spellchecker:ignore fqxr xjjx πthon -->
-
 ## Highlights
 
 - **Object Lifecycle Management**: :ak-enterprise :ak-preview Admins can now automatically schedule periodic reviews of authentik objects (applications, groups, roles) for compliance and auditing purposes.

website/docs/releases/2026/v2026.5.md

@@ -3,8 +3,6 @@ title: Release 2026.5
 slug: "/releases/2026.5"
 ---
 
-<!-- spellchecker:ignore fqxr xjjx -->
-
 ## Highlights
 
 - **Account Lockdown**: :ak-enterprise A new panic button for compromised accounts that can immediately cut off access, revoke tokens, end sessions, and leave an audit trail.
@@ -400,7 +398,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2026.5
 - tasks: threads instead of forks (#19476)
 - tenants: add option to mark flag as deprecated (#22063)
 - tenants: fix default schema in initial migration (#21114)
-- tenants: fix system flags removeable (cherry-pick #22163 to version-2026.5) (#22182)
+- tenants: fix system flags removable (cherry-pick #22163 to version-2026.5) (#22182)
 - tests: add mixin to launch traefik for tests requiring SSL (#22011)
 - tests: refactor test harness to split apart a single file (#21391)
 - translate: Updates for project authentik and language bg_BG (#22112)

website/docs/security/cves/CVE-2026-49443.md

@@ -1,5 +1,3 @@
-<!-- spellchecker:ignore GHSA-xp7f-xjjx-gwm8 -->
-
 # CVE-2026-49443 / GHSA-xp7f-xjjx-gwm8
 
 ## SourceStage bypass via empty POST

website/integrations/chat-communication-collaboration/grommunio/index.md

@@ -6,8 +6,6 @@ support_level: community
 
 import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx";
 
-<!-- spellchecker:ignore gromox -->
-
 ## What is grommunio?
 
 > grommunio is an open-source groupware server and collaboration platform offering email, calendar, contacts, tasks, video conferencing, and file sync. It is fully compatible with Microsoft Outlook via MAPI/RPC, EWS, and ActiveSync.